Registry Parse Data Analysis

This playbook leverages the RegistryParse automation to perform registry analysis and extract forensic artifacts. The automation includes common registry objects to extract which are useful for analyzing registry, or a user provides registry path to parse.

Windows Forensics · 3 tasks · 3 inputs · 1 output

Inputs

  • RegistryFileEntryID — The entry ID for the registry file to parse.
  • RegistryData — The data to parse out of the registry and output to context, including Users LastLoggedOnUser MachineRunOnce MachineStartup Timezone USB "All" selects all the options along with any default options.
  • CustomRegistryPaths — Custom registry path to parse.

Outputs

  • RegistryForensicData — The data parsed from the registry.

Flowchart

Start Start Registry Data parsing - RegistryParse Registry Data parsing RegistryParse Done Done